As companies need to streamline and rationalize their business processes, they tend to rely more heavily on specific data processing systems specialized in business process management. Such systems provide specific components such as a scheduler, transaction management facilities, service discovery, etc., to enable task orchestration in a heterogeneous environment. IBM WebSphere Process Server is such a business process management system based on IBM WebSphere Application Server. Based on a process model defined in an associated development environment, such as IBM WebSphere Business Modeler, the process server can then execute workflows and monitor them to gather various statistics on the executed processes.
Monitoring systems gather statistics on key indicators to provide metrics on a company's processes and performance. An important monitoring activity is to detect faulty or anomalous processes. Traditional monitoring systems provide two approaches for detecting anomalous behavior in a monitored process. In the first approach, users manually employ sophisticated analysis techniques to detect significant situations, investigate their root causes, and then take the appropriate corrective actions. The main problem with this approach is that situations are detected after their occurrence, not while the process is performing. The second approach for anomalous behavior management depends on domain experts to define criteria for the detection of the anomalous behavior. These criteria are usually encoded in terms of condition-action rules which are used by the monitoring system to automatically detect and handle significant situations. The main problem with this approach is that it assumes a priori knowledge of the anomalous behaviors and therefore does not detect hidden, potentially more critical, situations.
The state of the art technique in situation management involves: (1) the use of sophisticated analysis techniques to manually detect situations and investigate their root causes; and (2) the use of rule-based monitoring to automatically detect predefined situations.
The first approach allows users to employ sophisticated analysis techniques to detect situations, and investigate their root causes. These techniques include multidimensional analysis, statistical analysis, and other data mining capabilities such as: clustering of data values; determining associations between data elements; discovering repeated sequences of events; classifying data into predefined classes; and predicting the values of data elements. There are two problems with this approach. First, users have to manually inspect a huge amount of events and data. Second, situations are detected after their occurrence, not while the process is performing.
The second approach for situation detection depends on rule-based monitoring of the running instances. This approach allows domain experts to define criteria for the detection of critical situations. These criteria are encoded in terms of condition-action rules which are used by the system to monitor the running instances. Many inventions have proposed frameworks for defining and managing complex situations. For example, the U.S. patent application US 2005/0267765A1, filed by Jun-Jang Jeng et al., and entitled “Apparatus and Method for Policy-driven Business Process Exception Handling” provides an exception management framework that allows developers to define exception policies in a declarative manner. Also, U.S. Pat. No. 6,604,093, filed by Opher Etzion et al., and entitled “Situation Awareness System”, provides a method for situation management that allows users to define complex events using event composition operators. The main problem with this approach is that it only covers obvious situations, and does not allow the detection of hidden, potentially more critical, situations. Also, the process of manually defining detection criteria is inefficient, time consuming, and error-prone.
To solve some of the problems encountered in traditional situation management approaches, U.S. patent application US 2003/0149604A1, filed by Fabio Casati et al., and entitled “Exception Analysis, Prediction, and Prevention Method and System”, proposes a method that uses data mining techniques to generate classification rules that identities normal from exceptional process instances. The method is based on a training set of previously “labeled” process instances. The generated rules can be either investigated by the users to identify the causes of exceptional behavior or stored in a repository and compared with running instances to automatically detect exceptional behaviors. This method has several problems. First, the method depends on labeled process instances to train the classifier and therefore it can only detect previously-known exceptions. Moreover, the classification rules do not encode the dynamic behavior of the process instance (i.e., the change of state). This means that the approach does not detect process instances that exhibit exceptional sequence of states/events.